Have you ever wanted to know when a file is changed or accessed by the system or user? There is a program that does just that task called Inotify cron (incron).

Incron is for monitoring filesystem activity. It consists of a daemon and a table manipulator. You can use it a similar way as the regular cron. The difference is that the inotify cron handles filesystem events rather than time periods

incron provides a simple way how to solve many and many various situations. Every time when something depends on file system events, it’s a job for incron.

The incron table manipulator may be run under any regular user since it SUIDs. For manipulation with the tables use basically the same syntax as for the crontab program. You can import a table, remove and edit the current table.

The user table rows have the following syntax (use one or more spaces between elements):

<path> <mask> <command>

Where?

<path> is a filesystem path (each whitespace must be prepended by a backslash)<mask> is a symbolic or numeric mask for events (see man inotify for more details)<command> is an application or script to run on the events

Save the changes and open /etc/hosts and make a change and you should receive an email in your inbox.

At this point we have covered just the basics of what is possible with incron. Experiment with incron and see what other items you can monitor and what other commands you can execute on filesystem actions.